3 ms·

"Blockchain-based alternative to CAs" has been discussed before there even was the word blockchain (it was called sovereign keys, at least it's pretty close to

by hannob 7y ago

"Blockchain-based alternative to CAs" has been discussed before there even was the word blockchain (it was called sovereign keys, at least it's pretty close to a blockchain). I'd expect someone trying at least discussing why that didn't make it. Also I'm really annoyed by the "there was a problem with CAs in 2011, this system is really bad"-tune ignoring what has been changed since then. (E.g. the "You don’t know who all these CA intermediates are" may be true, but that's your problem, because you very well could know, the information is there.)

QuicksilverJohn 7y ago
It's actually pretty difficult to enumerate all trusted CAs (or even just what organizations are running CAs). Certificate Transparency certainly helps there, but it's not fully required, and doesn't solve all problems. The DigiNotar attack (from 2011) was mainly chosen because it's well known and easy to convey. It wasn't even that technically effectively because Chrome had Google's keys pinned, so it was immediately blocked and reported (like you would get with CT today). But, only in Chrome. More recent examples of mississuance, like tricking Comodo's OCR-based validation [0] or spoofing DNS to hijack Let's Encrypt issuance [1]. CA's are always going to be vulnerable to these sorts of attacks, and they have such a broad attack surface and so much systemic trust (i.e power) that can cause unbounded damages with any error. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=1311713 https://bugzilla.mozilla.org/show_bug.cgi?id=1311713 [1] https://www.wired.com/2017/04/hackers-hijacked-banks-entire-online-operation https://www.wired.com/2017/04/hackers-hijacked-banks-entire-...
- tialaramex 7y ago
  > It's actually pretty difficult to enumerate all trusted CAs (or even just what organizations are running CAs). Sure, but somebody else already did that so you can just rely on their work. https://wiki.mozilla.org/CA/Intermediate_Certificates https://wiki.mozilla.org/CA/Intermediate_Certificates
troquerre 7y ago
Author of the post here. My aim was to keep this post focused and cover the differences between Handshake and previous blockchain DNS attempts in a separate post. The keyword here is attempts: previous projects like Namecoin and ENS haven't really taken off. I think the reason has to do with the underlying technology and the go-to-market strategy (or lack thereof) of the projects. On the technology front, Handshake is the only naming blockchain that's launching with a light client that can resolve names. This may seem like a small thing but it's actually a critical input to success — without a light client, users would either need to run fullnodes (which no one does bc of the terrible ux) or rely on third party services. Third party services provide good ux but reduce the benefit of using the decentralized system in the first place. On the go-to-market front, the initial distribution of names is really important. It's much more important than the initial distribution of something like Bitcoin because names are non-fungible. They're digital real estate so if a whale is able to bid up all the good names before adoption, there will be no incentive for new participants to invest in the ecosystem (this happened to the previous projects). Handshake created a few GTM mechanics to prevent that outcome: * The Alexa top 100k domains have been pre-registered, so that only those domain owners can register their names on Handshake * Names are released for bidding over a 52 week period. If you hear about Handshake 8 months into launch there will still be a lot of good names available * Auctions last two weeks and require locking up your coins, making it difficult to bid and win on a lot of names at once. * Most importantly imo, Handshake coins are being distributed to developers, not investors. 70% of the initial Handshake coins are being airdropped to ~250k open-source developers. Basically, if you have a GitHub account with over 15 followers and an SSH key, you can anonymously claim Handshake coins. This is a no-strings attached giveaway so it will hopefully give developers a reason to check out the project, and it also makes it difficult for whales to buy up a lot of coins early on to outbid everyone.
- theli0nheart 7y ago
  I just tried to sign up but I got a message that namebase is in closed beta. How can I register?
  - troquerre 7y ago

by hannob 7y ago

QuicksilverJohn 7y ago

It's actually pretty difficult to enumerate all trusted CAs (or even just what organizations are running CAs). Certificate Transparency certainly helps there, but it's not fully required, and doesn't solve all problems. The DigiNotar attack (from 2011) was mainly chosen because it's well known and easy to convey. It wasn't even that technically effectively because Chrome had Google's keys pinned, so it was immediately blocked and reported (like you would get with CT today). But, only in Chrome. More recent examples of mississuance, like tricking Comodo's OCR-based validation [0] or spoofing DNS to hijack Let's Encrypt issuance [1]. CA's are always going to be vulnerable to these sorts of attacks, and they have such a broad attack surface and so much systemic trust (i.e power) that can cause unbounded damages with any error. [0] https://bugzilla.mozilla.org/show_bug.cgi?id=1311713 https://bugzilla.mozilla.org/show_bug.cgi?id=1311713 [1] https://www.wired.com/2017/04/hackers-hijacked-banks-entire-online-operation https://www.wired.com/2017/04/hackers-hijacked-banks-entire-...

tialaramex 7y ago
> It's actually pretty difficult to enumerate all trusted CAs (or even just what organizations are running CAs). Sure, but somebody else already did that so you can just rely on their work. https://wiki.mozilla.org/CA/Intermediate_Certificates https://wiki.mozilla.org/CA/Intermediate_Certificates

troquerre 7y ago

Author of the post here. My aim was to keep this post focused and cover the differences between Handshake and previous blockchain DNS attempts in a separate post. The keyword here is attempts: previous projects like Namecoin and ENS haven't really taken off. I think the reason has to do with the underlying technology and the go-to-market strategy (or lack thereof) of the projects. On the technology front, Handshake is the only naming blockchain that's launching with a light client that can resolve names. This may seem like a small thing but it's actually a critical input to success — without a light client, users would either need to run fullnodes (which no one does bc of the terrible ux) or rely on third party services. Third party services provide good ux but reduce the benefit of using the decentralized system in the first place. On the go-to-market front, the initial distribution of names is really important. It's much more important than the initial distribution of something like Bitcoin because names are non-fungible. They're digital real estate so if a whale is able to bid up all the good names before adoption, there will be no incentive for new participants to invest in the ecosystem (this happened to the previous projects). Handshake created a few GTM mechanics to prevent that outcome: * The Alexa top 100k domains have been pre-registered, so that only those domain owners can register their names on Handshake * Names are released for bidding over a 52 week period. If you hear about Handshake 8 months into launch there will still be a lot of good names available * Auctions last two weeks and require locking up your coins, making it difficult to bid and win on a lot of names at once. * Most importantly imo, Handshake coins are being distributed to developers, not investors. 70% of the initial Handshake coins are being airdropped to ~250k open-source developers. Basically, if you have a GitHub account with over 15 followers and an SSH key, you can anonymously claim Handshake coins. This is a no-strings attached giveaway so it will hopefully give developers a reason to check out the project, and it also makes it difficult for whales to buy up a lot of coins early on to outbid everyone.

theli0nheart 7y ago
I just tried to sign up but I got a message that namebase is in closed beta. How can I register?
- troquerre 7y ago